Most company sites treat recruitment as a mailto link. It looks like the cheap option, and it is — until you are three weeks into hiring and the shortlist lives in one person's inbox.
What actually goes wrong
- Applications arrive with no structure, so comparing candidates means opening twenty attachments.
- Nobody can tell which role an applicant meant when the posting was never a record in the first place.
- The page goes stale, because editing it needs a developer, so closed roles keep attracting applicants.
- CVs sit in a mailbox indefinitely, which is a data-protection problem waiting to be noticed.
The smaller version that works
You do not need an applicant tracking system. You need job postings as database records the HR team can open and close themselves, an application tied to a specific posting, a validated CV upload, and one screen listing who applied for what.
We have built exactly this shape twice — for a corporate group and for a catering company with seasonal staffing — and in both cases the deciding feature was the same: the team could publish a role without asking us.
Handle the uploads properly
A public file upload is an attack surface. Validate against an allow-list of types, check the file's real content rather than trusting its extension, store it under a generated name outside the web root, and serve downloads through an authenticated route. Decide how long you keep CVs, and delete them on schedule.
